UBUNTU-CVE-2026-123581: Medium severity ubuntu/rust-hickory-proto vulnerability
Hickory DNS hickory-proto through 0.26.0-alpha.1 and hickory-net 0.26.0-beta.1 before 0.26.2 contain a DNSSEC validation flaw that accepts a response as a positive answer when any valid RRset appears in the answer section, without checking that the RRset is responsive to the query. Attackers can supply signed but unrelated RRsets so that responses lacking matching records are validated as positive answers instead of as no-data responses.
Affected Software
Event History
Frequently Asked Questions
What conditions are required for exploitation?
An attacker must be able to provide DNS responses containing signed but unrelated RRsets. The affected resolver must perform DNSSEC validation and receive a response that lacks records matching the original query.
What is the security impact of a successful attack?
The resolver can validate the response as a positive answer even though the answer section does not contain a record responsive to the query. This causes a no-data response to be treated incorrectly as a positive result; the provided metrics rate integrity impact as low, with no stated confidentiality or availability impact.
Which Hickory component versions are affected?
hickory-proto is affected through 0.26.0-alpha.1. hickory-net is affected from 0.26.0-beta.1 before 0.26.2.